Deleted Data on PCs and Macs and How to Handle It

This document is intended as a primer to teach you about how deleted data is handled on PCs and Macs, and how to approach recovering it.

This is essential reading for anyone who has…

Deleted their wallet
Deleted their wallet’s vault data
Deleted their seed words or passwords from their hard drive
Formatted their hard drive
Re-installed their OS
Reset their computer
Run data recovery software to retrieve the deleted files

Whether you’re going to be able to recover your data or not depends upon lots of different factors…

1. The Type of Computer you are using

OSX vs Windows

The Operating System you use, and more specifically the file system, makes a huge difference to whether deleted data recovery is possible. Windows and OSX handle data very differently.

If you delete something on a Windows machine the file isn’t really gone, it’s still sitting on your hard drive in unallocated space until it gets overwritten minutes or months later. We have frequently recovered data from Windows machines that was deleted years ago. If you’re using a Mac running OSX though any data you delete is far more vulnerable, it’s usually gone in minutes and not recoverable.

2. The Type of Hard Drive you are using

HDDs vs SSDs

The type of hard drive you’re using is very important. SSDs use a feature called TRIM that overwrites data as soon as you delete it. This makes recovering deleted data from SSD’s virtually impossible. If you’re using an older style HDD then the outlook is much better as the deleted data will still reside on the disk until it is overwritten.

3. How long ago you Deleted the Files

Usually the longer the time the files have been deleted the less chance there is of recovering them due to the data being overwritten with fresher information.

Data Recovery Software

If you’re going to use data recovery software to recover your lost wallet and data files make sure you don’t fall into the trap of downloading it to the same hard drive you are trying to recover from. Every single month we are contacted by people who have done this and unfortunately they’ve destroyed any chance of successfully recovering their data. This is because downloading the software to the same hard disk frequently overwrites the data you’re trying to recover.

Always make sure you download data recovery software to a different machine and hook the drive with the deleted data up to it as a secondary device. This will avoid overwriting the data you want to recover. Always make sure you recover any data to the different machine too. You need to avoid any data being written to the disk you are trying to recover data from.

Partial Recoveries and Files that don’t open

So you may have run some data recovery software and got your files back. You are happy until you notice that certain files don’t open. This is very common, particularly with recoveries where the data was deleted a long time ago. What has happened is that in the time between you deleting the files and recovering them the data has been damaged by being partially overwritten. Once a file has been deleted the operating system marks the space it occupies on the hard drive as available and data will eventually be written to that space, slowly destroying the original file. A lot of people don’t realise that even when a computer is idle and not doing anything it is continuously writing data to the hard drive. It’s in this way that deleted data is slowly eroded away.

How to give yourself the best chance of recovering deleted data

As soon as you realise you’ve deleted data turn your machine off. Many people don’t realise that when a machine is on it is constantly reading and writing data to the hard drive, even when the machine appears to be idle. Switch the machine off and don’t switch it back on again. Contact us.

Advice for meddlers

Although the advice in the above paragraph is the best action to take, most people won’t do it because they can’t help but meddle and tinker around trying different ideas. Honestly, if you’ve got a small number of low grade alt coins in a wallet you’ve just deleted then tinker away, download some data recovery software (follow the advice above) and see how you get on. However if you’ve got a valuable Bitcoin or Ethereum wallet that you’ve just deleted, do not tinker. Make sure you turn your machine off and contact us. If you’ve lost access to your wallet and you don’t know how you should proceed, apply this simple program to your thought process:

if wallet = valuable then

stop messing about and contact us

else

download recovery software and try yourself

endif

Storing recovery seeds and passwords on a hard drive

If you’re storing your seed words &/or wallet passwords on your hard drive then you need to stop. Even worse are photos people take of their seed phrases that they store on their hard drive or backup to the cloud. These are really really bad ideas that leave you vulnerable to losing your crypto. The seed words are the most important part of any wallet. If you’ve recorded them correctly and stored them securely offline then you don’t have to worry about any type of deleted data problem as you can always recreate your wallet and it’s contents.